4708 matches found
CVE-2022-41913 Discourse-calendar exposes members of hidden groups
Discourse-calendar is a plugin for the Discourse messaging platform which adds the ability to create a dynamic calendar in the first post of a topic. Members of private groups or public groups with private members can be listed by users, who can create and edit post events. This vulnerability onl...
UBUNTU-CVE-2022-3265
A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. It was possible to exploit a vulnerability in setting the labels colour feature which could lead to a stored XSS that allowed attackers to perfo...
CVE-2022-39887
Improper access control vulnerability in clearAllGlobalProxy in MiscPolicy prior to SMR Nov-2022 Release 1 allows local attacker to configure EDM setting...
CVE-2022-39887
Improper access control vulnerability in clearAllGlobalProxy in MiscPolicy prior to SMR Nov-2022 Release 1 allows local attacker to configure EDM setting...
Improper access control
Improper access control vulnerability in clearAllGlobalProxy in MiscPolicy prior to SMR Nov-2022 Release 1 allows local attacker to configure EDM setting...
PT-2022-24267 · Gitlab · Gitlab Ce/Ee +1
Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 15.0 through 15.3.4 GitLab CE/EE versions 15.4 through 15.4.3 GitLab CE/EE versions 15.5 through 15.5.1 Description: An improper authorization issue in GitLab CE/EE allows malicious users to set emojis on internal notes...
CVE-2022-39887: Improper Access Control
Improper access control vulnerability in clearAllGlobalProxy in MiscPolicy prior to SMR Nov-2022 Release 1 allows local attacker to configure EDM setting...
CVE-2022-39887
Improper access control vulnerability in clearAllGlobalProxy in MiscPolicy prior to SMR Nov-2022 Release 1 allows local attacker to configure EDM setting...
CVE-2022-3819
Removed by vendor...
PT-2022-27388 · Tenda · Tenda Ax12
Name of the Vulnerable Software and Affected Versions: Tenda AX12 version V22.03.01.16 cn Description: The issue is related to command injection via the goform/fast setting internet set API endpoint. This allows for potential malicious commands to be executed. Recommendations: For Tenda AX12...
Fancier Author Box by ThematoSoup <= 1.4 - Admin+ Stored XSS
The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. 1. Open the setting page of this plugin. 2. There...
Find and Replace All < 1.3 - Reflected Cross Site Scripting
The plugin does not sanitize and escape some parameters from its setting page before outputting them back to the user, leading to a Reflected Cross-Site Scripting issue. PoC...
Fancier Author Box by ThematoSoup <= 1.4 - Admin+ Stored XSS
The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. PoC 1. Open the setting page of this plugin. 2...
PT-2022-24190 · Unknown · Webfactory Under Construction Plugin
Name of the Vulnerable Software and Affected Versions: WebFactory Under Construction Plugin affected versions not specified Description: A problematic vulnerability has been found in the WebFactory Under Construction Plugin, affecting the Plugin Setting Handler component. This issue leads to...
PT-2022-24144 · Unknown · Pdf & Print Plugin
Name of the Vulnerable Software and Affected Versions: PDF & Print Plugin affected versions not specified Description: A vulnerability was found in the PDF & Print Plugin, affecting an unknown part of the component Setting Handler. The issue leads to cross-site scripting and can be initiated...
November 1, 2022, update for Office 2016 (KB5002306)
None None...
SUSE-SU-2022:3750-1 Security update for SUSE Manager Server 4.3
This update fixes the following issues: cobbler: - Consider case of 'nextserver' being a hostname during migration of Cobbler collections. - Fix problem with 'proxyurlext' setting being None type. - Fix settings migration schema to work while upgrading on existing running Uyuni and SUSE Manager...
[VPN Plugin] Transfer Login keeps Loading with Non-English language setting
In Citrix Gateway VPN environment, you may observe the following issue when "Transfer Login": After clicking "Transfer" on Client VPN plugin, the button keepsspinning loading and stuck. Logs investigation show the following clues: Problem can only be observed in Non-English language setting Plugi...
Tenda AC15 缓冲区错误漏洞
The Tenda AC15 is a wireless router from the Chinese company Tenda. The Tenda AC15 suffers from a buffer overflow vulnerability that originates from the timeZone parameter of the formfastsettingwifiset function that lacks length validation for input data. An attacker could exploit the vulnerabili...
